The SEC has charged four public companies with misleading disclosures about cyber risks and intrusions.